<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Security Namespace Configuration :: Spring Security</title>
<link rel="canonical" href="../../../servlet/configuration/xml-namespace.html">
<link rel="prev" href="kotlin.html">
<link rel="next" href="../test/index.html">
<meta name="generator" content="Antora 3.0.0">
<link rel="stylesheet" href="../../../_/css/site.css">
<link href="../../../_/img/favicon.ico" rel='shortcut icon' type='image/vnd.microsoft.icon'>
<link rel="stylesheet" href="../../../_/css/vendor/docsearch.min.css">

<script>var uiRootPath = '../../../_'</script>
</head>
<body class="article">
<header class="header">
<nav class="navbar">
<div class="navbar-brand">
<a class="navbar-item" href="https://spring.io">
<img id="springlogo" class="block" src="../../../_/img/spring-logo.svg" alt="Spring">
</a>
<button class="navbar-burger" data-target="topbar-nav">
<span></span>
<span></span>
<span></span>
</button>
</div>
<div id="topbar-nav" class="navbar-menu">
<div class="navbar-end">
<div class="navbar-item has-dropdown is-hoverable">
<a class="navbar-link" href="xml-namespace.html#">Why Spring</a>
<div class="navbar-dropdown">
<a class="navbar-item" href="https://spring.io/why-spring">Overview</a>
<a class="navbar-item" href="https://spring.io/microservices">Microservices</a>
<a class="navbar-item" href="https://spring.io/reactive">Reactive</a>
<a class="navbar-item" href="https://spring.io/event-driven">Event Driven</a>
<a class="navbar-item" href="https://spring.io/cloud">Cloud</a>
<a class="navbar-item" href="https://spring.io/web-applications">Web Applications</a>
<a class="navbar-item" href="https://spring.io/serverless">Serverless</a>
<a class="navbar-item" href="https://spring.io/batch">Batch</a>
</div>
</div>
<div class="navbar-item has-dropdown is-hoverable">
<a class="navbar-link" href="xml-namespace.html#">Learn</a>
<div class="navbar-dropdown">
<a class="navbar-item" href="https://spring.io/learn">Overview</a>
<a class="navbar-item" href="https://spring.io/quickstart">Quickstart</a>
<a class="navbar-item" href="https://spring.io/guides">Guides</a>
<a class="navbar-item" href="https://spring.io/blog">Blog</a>
</div>
</div>
<div class="navbar-item has-dropdown is-hoverable">
<a class="navbar-link" href="xml-namespace.html#">Projects</a>
<div class="navbar-dropdown">
<a class="navbar-item" href="https://spring.io/projects">Overview</a>
<a class="navbar-item" href="https://spring.io/projects/spring-boot">Spring Boot</a>
<a class="navbar-item" href="https://spring.io/projects/spring-framework">Spring Framework</a>
<a class="navbar-item" href="https://spring.io/projects/spring-cloud">Spring Cloud</a>
<a class="navbar-item" href="https://spring.io/projects/spring-cloud-dataflow">Spring Cloud Data Flow</a>
<a class="navbar-item" href="https://spring.io/projects/spring-data">Spring Data</a>
<a class="navbar-item" href="https://spring.io/projects/spring-integration">Spring Integration</a>
<a class="navbar-item" href="https://spring.io/projects/spring-batch">Spring Batch</a>
<a class="navbar-item" href="https://spring.io/projects/spring-security">Spring Security</a>
<a class="navbar-item navbar-item-special" href="https://spring.io/projects">View all projects</a>
<a class="navbar-item" href="https://spring.io/tools">Spring Tools 4</a>
<a class="navbar-item navbar-item-special-2" href="https://start.spring.io">Spring Initializr <svg class="external-link-icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><polyline points="15 10.94 15 15 1 15 1 1 5.06 1" fill="none" stroke="currentColor" stroke-miterlimit="10" stroke-width="2"></polyline><polyline points="8.93 1 15 1 15 7.07" fill="none" stroke="currentColor" stroke-miterlimit="10" stroke-width="2"></polyline><line x1="15" y1="1" x2="8" y2="8" fill="none" stroke="currentColor" stroke-miterlimit="10" stroke-width="2"></line></svg></a>
</div>
</div>
<a class="navbar-item" href="https://spring.io/training">Training</a>
<a class="navbar-item" href="https://spring.io/support">Support</a>
<div class="navbar-item has-dropdown is-hoverable is-community">
<a class="navbar-link" href="xml-namespace.html#">Community</a>
<div class="navbar-dropdown">
<a class="navbar-item" href="https://spring.io/community">Overview</a>
<a class="navbar-item" href="https://spring.io/events">Events</a>
<a class="navbar-item" href="https://spring.io/team">Team</a>
</div>
</div>
</div>
</div>
<div id="switch-theme">
<input type="checkbox" id="switch-theme-checkbox" />
<label for="switch-theme-checkbox">Dark Theme</label>
</div>
</nav>
</header>
<div class="body">
<div class="nav-container" data-component="ROOT" data-version="5.6.0-RC1">
<aside class="nav">
<div class="panels">
<div class="nav-panel-menu is-active" data-panel="menu">
<nav class="nav-menu">
<h3 class="title"><a href="../../index.html">Spring Security</a></h3>
<ul class="nav-list">
<li class="nav-item" data-depth="0">
<ul class="nav-list">
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../index.html">Overview</a>
</li>
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../prerequisites.html">Prerequisites</a>
</li>
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../community.html">Community</a>
</li>
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../whats-new.html">What&#8217;s New</a>
</li>
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../getting-spring-security.html">Getting Spring Security</a>
</li>
<li class="nav-item" data-depth="1">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../features/index.html">Features</a>
<ul class="nav-list">
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../features/authentication/index.html">Authentication</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/authentication/password-storage.html">Password Storage</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../features/exploits/index.html">Protection Against Exploits</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/exploits/csrf.html">CSRF</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/exploits/headers.html">HTTP Headers</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/exploits/http.html">HTTP Requests</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../features/integrations/index.html">Integrations</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/integrations/cryptography.html">Cryptography</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/integrations/data.html">Spring Data</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/integrations/concurrency.html">Java&#8217;s Concurrency APIs</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/integrations/jackson.html">Jackson</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../features/integrations/localization.html">Localization</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../modules.html">Project Modules</a>
</li>
<li class="nav-item" data-depth="1">
<a class="nav-link" href="../../samples.html">Samples</a>
</li>
<li class="nav-item" data-depth="1">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../index.html">Servlet Applications</a>
<ul class="nav-list">
<li class="nav-item" data-depth="2">
<a class="nav-link" href="../getting-started.html">Getting Started</a>
</li>
<li class="nav-item" data-depth="2">
<a class="nav-link" href="../architecture.html">Architecture</a>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../authentication/index.html">Authentication</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/architecture.html">Authentication Architecture</a>
</li>
<li class="nav-item" data-depth="3">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../authentication/passwords/index.html">Username/Password</a>
<ul class="nav-list">
<li class="nav-item" data-depth="4">
<button class="nav-item-toggle"></button>
<span class="nav-text">Reading Username/Password</span>
<ul class="nav-list">
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/form.html">Form</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/basic.html">Basic</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/digest.html">Digest</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="4">
<button class="nav-item-toggle"></button>
<span class="nav-text">Password Storage</span>
<ul class="nav-list">
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/in-memory.html">In Memory</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/jdbc.html">JDBC</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/user-details.html">UserDetails</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/user-details-service.html">UserDetailsService</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/password-encoder.html">PasswordEncoder</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/dao-authentication-provider.html">DaoAuthenticationProvider</a>
</li>
<li class="nav-item" data-depth="5">
<a class="nav-link" href="../authentication/passwords/ldap.html">LDAP</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/session-management.html">Session Management</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/rememberme.html">Remember Me</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/openid.html">OpenID</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/anonymous.html">Anonymous</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/preauth.html">Pre-Authentication</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/jaas.html">JAAS</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/cas.html">CAS</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/x509.html">X509</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/runas.html">Run-As</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/logout.html">Logout</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authentication/events.html">Authentication Events</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../authorization/index.html">Authorization</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authorization/architecture.html">Authorization Architecture</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authorization/authorize-requests.html">Authorize HTTP Requests</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authorization/expression-based.html">Expression-Based Access Control</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authorization/secure-objects.html">Secure Object Implementations</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authorization/method-security.html">Method Security</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../authorization/acls.html">Domain Object Security ACLs</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../oauth2/index.html">OAuth2</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../oauth2/oauth2-login.html">OAuth2 Log In</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../oauth2/oauth2-client.html">OAuth2 Client</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../oauth2/oauth2-resourceserver.html">OAuth2 Resource Server</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<a class="nav-link" href="../saml2/index.html">SAML2</a>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../exploits/index.html">Protection Against Exploits</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../exploits/csrf.html">Cross Site Request Forgery (CSRF) for Servlet Environments</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../exploits/headers.html">Security HTTP Response Headers</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../exploits/http.html">HTTP</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../exploits/firewall.html">HttpFirewall</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../integrations/index.html">Integrations</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../integrations/servlet-api.html">Servlet APIs</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../integrations/mvc.html">Spring MVC</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../integrations/websocket.html">WebSocket</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../integrations/cors.html">Spring&#8217;s CORS Support</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../integrations/jsp-taglibs.html">JSP Taglib</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<span class="nav-text">Configuration</span>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="java.html">Java Configuration</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="kotlin.html">Kotlin Configuration</a>
</li>
<li class="nav-item is-current-page" data-depth="3">
<a class="nav-link" href="xml-namespace.html">Namespace Configuration</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../test/index.html">Testing</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../test/method.html">Method Security</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../test/mockmvc.html">MockMvc Support</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../appendix/index.html">Appendix</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../appendix/database-schema.html">Database Schemas</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../appendix/namespace.html">XML Namespace</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../appendix/faq.html">FAQ</a>
</li>
</ul>
</li>
</ul>
</li>
<li class="nav-item" data-depth="1">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../reactive/index.html">Reactive Applications</a>
<ul class="nav-list">
<li class="nav-item" data-depth="2">
<a class="nav-link" href="../../reactive/getting-started.html">Getting Started</a>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<span class="nav-text">Authentication</span>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/authentication/x509.html">X.509 Authentication</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/authentication/logout.html">Logout</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<span class="nav-text">Authorization</span>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/authorization/method.html">EnableReactiveMethodSecurity</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../reactive/oauth2/index.html">OAuth2</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/oauth2/login.html">OAuth 2.0 Login</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/oauth2/oauth2-client.html">OAuth2 Client</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/oauth2/resource-server.html">OAuth 2.0 Resource Server</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/registered-oauth2-authorized-client.html">@RegisteredOAuth2AuthorizedClient</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<a class="nav-link" href="../../reactive/exploits/index.html">Protection Against Exploits</a>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/exploits/csrf.html">CSRF</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/exploits/headers.html">Headers</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/exploits/http.html">HTTP Requests</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<button class="nav-item-toggle"></button>
<span class="nav-text">Integrations</span>
<ul class="nav-list">
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/integrations/cors.html">CORS</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/integrations/rsocket.html">RSocket</a>
</li>
<li class="nav-item" data-depth="3">
<a class="nav-link" href="../../reactive/integrations/webclient.html">WebClient</a>
</li>
</ul>
</li>
<li class="nav-item" data-depth="2">
<a class="nav-link" href="../../reactive/test.html">Testing</a>
</li>
<li class="nav-item" data-depth="2">
<a class="nav-link" href="../../reactive/configuration/webflux.html">WebFlux Security</a>
</li>
</ul>
</li>
</ul>
</li>
</ul>
</nav>
</div>
<div class="nav-panel-explore" data-panel="explore">
<div class="context">
<span class="title">Spring Security</span>
<span class="version">5.6.0-RC1</span>
</div>
<ul class="components">
<li class="component is-current">
<a class="title" href="../../../index.html">Spring Security</a>
<ul class="versions">
<li class="version">
<a href="../../../6.0/index.html">6.0.0-SNAPSHOT</a>
</li>
<li class="version">
<a href="../../../6.0.0-M3/index.html">6.0.0-M3</a>
</li>
<li class="version">
<a href="../../../6.0.0-M2/index.html">6.0.0-M2</a>
</li>
<li class="version">
<a href="../../../6.0.0-M1/index.html">6.0.0-M1</a>
</li>
<li class="version">
<a href="../../../5.7/index.html">5.7.0-SNAPSHOT</a>
</li>
<li class="version">
<a href="../../../5.7.0-RC1/index.html">5.7.0-RC1</a>
</li>
<li class="version">
<a href="../../../5.7.0-M3/index.html">5.7.0-M3</a>
</li>
<li class="version">
<a href="../../../5.7.0-M2/index.html">5.7.0-M2</a>
</li>
<li class="version">
<a href="../../../5.7.0-M1/index.html">5.7.0-M1</a>
</li>
<li class="version">
<a href="../../../5.6.4/index.html">5.6.4-SNAPSHOT</a>
</li>
<li class="version is-latest">
<a href="../../../index.html">5.6.3</a>
</li>
<li class="version">
<a href="../../../5.6.2/index.html">5.6.2</a>
</li>
<li class="version">
<a href="../../../5.6.1/index.html">5.6.1</a>
</li>
<li class="version">
<a href="../../../5.6.0/index.html">5.6.0</a>
</li>
<li class="version is-current">
<a href="../../index.html">5.6.0-RC1</a>
</li>
</ul>
</li>
</ul>
</div>
</div>
</aside>
</div>
<main class="article">
<div class="toolbar" role="navigation">
<button class="nav-toggle"></button>
<nav class="breadcrumbs" aria-label="breadcrumbs">
<ul>
<li><a href="../../index.html">Spring Security</a></li>
<li><a href="../index.html">Servlet Applications</a></li>
<li>Configuration</li>
<li><a href="xml-namespace.html">Namespace Configuration</a></li>
</ul>
</nav>
<div class="search">
<input id="search-input" type="text" placeholder="Search docs">
</div>
<div class="page-versions">
<button class="version-menu-toggle" title="Show other versions of page">5.6.0-RC1</button>
<div class="version-menu">
<a class="version" href="../../../6.0/servlet/configuration/xml-namespace.html">6.0.0-SNAPSHOT</a>
<a class="version" href="../../../6.0.0-M3/servlet/configuration/xml-namespace.html">6.0.0-M3</a>
<a class="version" href="../../../6.0.0-M2/servlet/configuration/xml-namespace.html">6.0.0-M2</a>
<a class="version" href="../../../6.0.0-M1/servlet/configuration/xml-namespace.html">6.0.0-M1</a>
<a class="version" href="../../../5.7/servlet/configuration/xml-namespace.html">5.7.0-SNAPSHOT</a>
<a class="version" href="../../../5.7.0-RC1/servlet/configuration/xml-namespace.html">5.7.0-RC1</a>
<a class="version" href="../../../5.7.0-M3/servlet/configuration/xml-namespace.html">5.7.0-M3</a>
<a class="version" href="../../../5.7.0-M2/servlet/configuration/xml-namespace.html">5.7.0-M2</a>
<a class="version" href="../../../5.7.0-M1/servlet/configuration/xml-namespace.html">5.7.0-M1</a>
<a class="version" href="../../../5.6.4/servlet/configuration/xml-namespace.html">5.6.4-SNAPSHOT</a>
<a class="version" href="../../../servlet/configuration/xml-namespace.html">5.6.3</a>
<a class="version" href="../../../5.6.2/servlet/configuration/xml-namespace.html">5.6.2</a>
<a class="version" href="../../../5.6.1/servlet/configuration/xml-namespace.html">5.6.1</a>
<a class="version" href="../../../5.6.0/servlet/configuration/xml-namespace.html">5.6.0</a>
<a class="version is-current" href="xml-namespace.html">5.6.0-RC1</a>
</div>
</div>
<div class="edit-this-page"><a href="https://github.com/spring-projects/spring-security/blob/5.6.0-RC1/docs/modules/ROOT/pages/servlet/configuration/xml-namespace.adoc">Edit this Page</a></div>
</div>
<div class="content">
<aside class="toc sidebar" data-title="Contents" data-levels="2">
<div class="toc-menu"></div>
</aside>
<article class="doc">
<div class="admonitionblock important">
<table>
<tbody><tr>
<td class="icon">
<i class="fa icon-important" title="Important"></i>
</td>
<td class="content">
<div class="paragraph">
<p> For the latest stable version, please use <a href="../../../servlet/configuration/xml-namespace.html">Spring Security 5.6.3</a>!</p>
</div>
</td>
</tr></tbody>
</table>
</div>
<h1 id="page-title" class="page">Security Namespace Configuration</h1>
<div class="sect1">
<h2 id="_introduction"><a class="anchor" href="xml-namespace.html#_introduction"></a>Introduction</h2>
<div class="sectionbody">
<div class="paragraph">
<p>Namespace configuration has been available since version 2.0 of the Spring Framework.
It allows you to supplement the traditional Spring beans application context syntax with elements from additional XML schema.
You can find more information in the Spring <a href="https://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/">Reference Documentation</a>.
A namespace element can be used simply to allow a more concise way of configuring an individual bean or, more powerfully, to define an alternative configuration syntax which more closely matches the problem domain and hides the underlying complexity from the user.
A simple element may conceal the fact that multiple beans and processing steps are being added to the application context.
For example, adding the following element from the security namespace to an application context will start up an embedded LDAP server for testing use within the application:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;security:ldap-server /&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>This is much simpler than wiring up the equivalent Apache Directory Server beans.
The most common alternative configuration requirements are supported by attributes on the <code>ldap-server</code> element and the user is isolated from worrying about which beans they need to create and what the bean property names are.
<sup class="footnote">[<a id="_footnoteref_1" class="footnote" href="xml-namespace.html#_footnotedef_1" title="View footnote.">1</a>]</sup>.].
Use of a good XML editor while editing the application context file should provide information on the attributes and elements that are available.
We would recommend that you try out the <a href="https://spring.io/tools">Eclipse IDE with Spring Tools</a> as it has special features for working with standard Spring namespaces.</p>
</div>
<div class="paragraph">
<p>To start using the security namespace in your application context, you need to have the <code>spring-security-config</code> jar on your classpath.
Then all you need to do is add the schema declaration to your application context file:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
		https://www.springframework.org/schema/beans/spring-beans-3.0.xsd
		http://www.springframework.org/schema/security
		https://www.springframework.org/schema/security/spring-security.xsd"&gt;
	...
&lt;/beans&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>In many of the examples you will see (and in the sample applications), we will often use "security" as the default namespace rather than "beans", which means we can omit the prefix on all the security namespace elements, making the content easier to read.
You may also want to do this if you have your application context divided up into separate files and have most of your security configuration in one of them.
Your security application context file would then start like this</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
		https://www.springframework.org/schema/beans/spring-beans-3.0.xsd
		http://www.springframework.org/schema/security
		https://www.springframework.org/schema/security/spring-security.xsd"&gt;
	...
&lt;/beans:beans&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>We&#8217;ll assume this syntax is being used from now on in this chapter.</p>
</div>
<div class="sect2">
<h3 id="_design_of_the_namespace"><a class="anchor" href="xml-namespace.html#_design_of_the_namespace"></a>Design of the Namespace</h3>
<div class="paragraph">
<p>The namespace is designed to capture the most common uses of the framework and provide a simplified and concise syntax for enabling them within an application.
The design is based around the large-scale dependencies within the framework, and can be divided up into the following areas:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><em>Web/HTTP Security</em> - the most complex part.
Sets up the filters and related service beans used to apply the framework authentication mechanisms, to secure URLs, render login and error pages and much more.</p>
</li>
<li>
<p><em>Business Object (Method) Security</em> - options for securing the service layer.</p>
</li>
<li>
<p><em>AuthenticationManager</em> - handles authentication requests from other parts of the framework.</p>
</li>
<li>
<p><em>AccessDecisionManager</em> - provides access decisions for web and method security.
A default one will be registered, but you can also choose to use a custom one, declared using normal Spring bean syntax.</p>
</li>
<li>
<p><em>AuthenticationProvider</em>s - mechanisms against which the authentication manager authenticates users.
The namespace provides supports for several standard options and also a means of adding custom beans declared using a traditional syntax.</p>
</li>
<li>
<p><em>UserDetailsService</em> - closely related to authentication providers, but often also required by other beans.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>We&#8217;ll see how to configure these in the following sections.</p>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="ns-getting-started"><a class="anchor" href="xml-namespace.html#ns-getting-started"></a>Getting Started with Security Namespace Configuration</h2>
<div class="sectionbody">
<div class="paragraph">
<p>In this section, we&#8217;ll look at how you can build up a namespace configuration to use some of the main features of the framework.
Let&#8217;s assume you initially want to get up and running as quickly as possible and add authentication support and access control to an existing web application, with a few test logins.
Then we&#8217;ll look at how to change over to authenticating against a database or other security repository.
In later sections we&#8217;ll introduce more advanced namespace configuration options.</p>
</div>
<div class="sect2">
<h3 id="ns-web-xml"><a class="anchor" href="xml-namespace.html#ns-web-xml"></a>web.xml Configuration</h3>
<div class="paragraph">
<p>The first thing you need to do is add the following filter declaration to your <code>web.xml</code> file:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;filter&gt;
&lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
&lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
&lt;/filter&gt;

&lt;filter-mapping&gt;
&lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
&lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>This provides a hook into the Spring Security web infrastructure.
<code>DelegatingFilterProxy</code> is a Spring Framework class which delegates to a filter implementation which is defined as a Spring bean in your application context.
In this case, the bean is named "springSecurityFilterChain", which is an internal infrastructure bean created by the namespace to handle web security.
Note that you should not use this bean name yourself.
Once you&#8217;ve added this to your <code>web.xml</code>, you&#8217;re ready to start editing your application context file.
Web security services are configured using the <code>&lt;http&gt;</code> element.</p>
</div>
</div>
<div class="sect2">
<h3 id="ns-minimal"><a class="anchor" href="xml-namespace.html#ns-minimal"></a>A Minimal &lt;http&gt; Configuration</h3>
<div class="paragraph">
<p>All you need to enable web security to begin with is</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;http&gt;
&lt;intercept-url pattern="/**" access="hasRole('USER')" /&gt;
&lt;form-login /&gt;
&lt;logout /&gt;
&lt;/http&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>Which says that we want all URLs within our application to be secured, requiring the role <code>ROLE_USER</code> to access them, we want to log in to the application using a form with username and password, and that we want a logout URL registered which will allow us to log out of the application.
<code>&lt;http&gt;</code> element is the parent for all web-related namespace functionality.
The <code>&lt;intercept-url&gt;</code> element defines a <code>pattern</code> which is matched against the URLs of incoming requests using an ant path style syntax <sup class="footnote">[<a id="_footnoteref_2" class="footnote" href="xml-namespace.html#_footnotedef_2" title="View footnote.">2</a>]</sup> for more details on how matches are actually performed.].
You can also use regular-expression matching as an alternative (see the namespace appendix for more details).
The <code>access</code> attribute defines the access requirements for requests matching the given pattern.
With the default configuration, this is typically a comma-separated list of roles, one of which a user must have to be allowed to make the request.
The prefix "ROLE_" is a marker which indicates that a simple comparison with the user&#8217;s authorities should be made.
In other words, a normal role-based check should be used.
Access-control in Spring Security is not limited to the use of simple roles (hence the use of the prefix to differentiate between different types of security attributes).
We&#8217;ll see later how the interpretation can vary <sup class="footnote">[<a id="_footnoteref_3" class="footnote" href="xml-namespace.html#_footnotedef_3" title="View footnote.">3</a>]</sup>.
In Spring Security 3.0, the attribute can also be populated with an <a href="../authorization/expression-based.html#el-access" class="xref page">EL expression</a>.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p>You can use multiple <code>&lt;intercept-url&gt;</code> elements to define different access requirements for different sets of URLs, but they will be evaluated in the order listed and the first match will be used.
So you must put the most specific matches at the top.
You can also add a <code>method</code> attribute to limit the match to a particular HTTP method (<code>GET</code>, <code>POST</code>, <code>PUT</code> etc.).</p>
</div>
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>To add some users, you can define a set of test data directly in the namespace:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;authentication-manager&gt;
&lt;authentication-provider&gt;
	&lt;user-service&gt;
	&lt;!-- Password is prefixed with {noop} to indicate to DelegatingPasswordEncoder that
	NoOpPasswordEncoder should be used. This is not safe for production, but makes reading
	in samples easier. Normally passwords should be hashed using BCrypt --&gt;
	&lt;user name="jimi" password="{noop}jimispassword" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
	&lt;user name="bob" password="{noop}bobspassword" authorities="ROLE_USER" /&gt;
	&lt;/user-service&gt;
&lt;/authentication-provider&gt;
&lt;/authentication-manager&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>This is an example of a secure way of storing the same passwords.
The password is prefixed with <code>{bcrypt}</code> to instruct <code>DelegatingPasswordEncoder</code>, which supports any configured <code>PasswordEncoder</code> for matching, that the passwords are hashed using BCrypt:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;authentication-manager&gt;
&lt;authentication-provider&gt;
	&lt;user-service&gt;
	&lt;user name="jimi" password="{bcrypt}$2a$10$ddEWZUl8aU0GdZPPpy7wbu82dvEw/pBpbRvDQRqA41y6mK1CoH00m"
			authorities="ROLE_USER, ROLE_ADMIN" /&gt;
	&lt;user name="bob" password="{bcrypt}$2a$10$/elFpMBnAYYig6KRR5bvOOYeZr1ie1hSogJryg9qDlhza4oCw1Qka"
			authorities="ROLE_USER" /&gt;
	&lt;user name="jimi" password="{noop}jimispassword" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
	&lt;user name="bob" password="{noop}bobspassword" authorities="ROLE_USER" /&gt;
	&lt;/user-service&gt;
&lt;/authentication-provider&gt;
&lt;/authentication-manager&gt;</code></pre>
</div>
</div>
<div class="sidebarblock">
<div class="content">
<div class="paragraph">
<p>If you are familiar with pre-namespace versions of the framework, you can probably already guess roughly what&#8217;s going on here.
The <code>&lt;http&gt;</code> element is responsible for creating a <code>FilterChainProxy</code> and the filter beans which it uses.
Common problems like incorrect filter ordering are no longer an issue as the filter positions are predefined.</p>
</div>
<div class="paragraph">
<p>The <code>&lt;authentication-provider&gt;</code> element creates a <code>DaoAuthenticationProvider</code> bean and the <code>&lt;user-service&gt;</code> element creates an <code>InMemoryDaoImpl</code>.
All <code>authentication-provider</code> elements must be children of the <code>&lt;authentication-manager&gt;</code> element, which creates a <code>ProviderManager</code> and registers the authentication providers with it.
You can find more detailed information on the beans that are created in the <a href="../appendix/namespace.html#appendix-namespace" class="xref page">namespace appendix</a>.
It&#8217;s worth cross-checking this if you want to start understanding what the important classes in the framework are and how they are used, particularly if you want to customise things later.</p>
</div>
</div>
</div>
<div class="paragraph">
<p>The configuration above defines two users, their passwords and their roles within the application (which will be used for access control).
It is also possible to load user information from a standard properties file using the <code>properties</code> attribute on <code>user-service</code>.
See the section on <a href="../authentication/passwords/in-memory.html#servlet-authentication-inmemory" class="xref page">in-memory authentication</a> for more details on the file format.
Using the <code>&lt;authentication-provider&gt;</code> element means that the user information will be used by the authentication manager to process authentication requests.
You can have multiple <code>&lt;authentication-provider&gt;</code> elements to define different authentication sources and each will be consulted in turn.</p>
</div>
<div class="paragraph">
<p>At this point you should be able to start up your application and you will be required to log in to proceed.
Try it out, or try experimenting with the "tutorial" sample application that comes with the project.</p>
</div>
<div class="sect3">
<h4 id="ns-form-target"><a class="anchor" href="xml-namespace.html#ns-form-target"></a>Setting a Default Post-Login Destination</h4>
<div class="paragraph">
<p>If a form login isn&#8217;t prompted by an attempt to access a protected resource, the <code>default-target-url</code> option comes into play.
This is the URL the user will be taken to after successfully logging in, and defaults to "/".
You can also configure things so that the user <em>always</em> ends up at this page (regardless of whether the login was "on-demand" or they explicitly chose to log in) by setting the <code>always-use-default-target</code> attribute to "true".
This is useful if your application always requires that the user starts at a "home" page, for example:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;http pattern="/login.htm*" security="none"/&gt;
&lt;http use-expressions="false"&gt;
&lt;intercept-url pattern='/**' access='ROLE_USER' /&gt;
&lt;form-login login-page='/login.htm' default-target-url='/home.htm'
		always-use-default-target='true' /&gt;
&lt;/http&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>For even more control over the destination, you can use the <code>authentication-success-handler-ref</code> attribute as an alternative to <code>default-target-url</code>.
The referenced bean should be an instance of <code>AuthenticationSuccessHandler</code>.</p>
</div>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="ns-web-advanced"><a class="anchor" href="xml-namespace.html#ns-web-advanced"></a>Advanced Web Features</h2>
<div class="sectionbody">
<div class="sect2">
<h3 id="ns-custom-filters"><a class="anchor" href="xml-namespace.html#ns-custom-filters"></a>Adding in Your Own Filters</h3>
<div class="paragraph">
<p>If you&#8217;ve used Spring Security before, you&#8217;ll know that the framework maintains a chain of filters in order to apply its services.
You may want to add your own filters to the stack at particular locations or use a Spring Security filter for which there isn&#8217;t currently a namespace configuration option (CAS, for example).
Or you might want to use a customized version of a standard namespace filter, such as the <code>UsernamePasswordAuthenticationFilter</code> which is created by the <code>&lt;form-login&gt;</code> element, taking advantage of some of the extra configuration options which are available by using the bean explicitly.
How can you do this with namespace configuration, since the filter chain is not directly exposed?</p>
</div>
<div class="paragraph">
<p>The order of the filters is always strictly enforced when using the namespace.
When the application context is being created, the filter beans are sorted by the namespace handling code and the standard Spring Security filters each have an alias in the namespace and a well-known position.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<div class="paragraph">
<p>In previous versions, the sorting took place after the filter instances had been created, during post-processing of the application context.
In version 3.0+ the sorting is now done at the bean metadata level, before the classes have been instantiated.
This has implications for how you add your own filters to the stack as the entire filter list must be known during the parsing of the <code>&lt;http&gt;</code> element, so the syntax has changed slightly in 3.0.</p>
</div>
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>The filters, aliases and namespace elements/attributes which create the filters are shown in <a href="xml-namespace.html#filter-stack">Standard Filter Aliases and Ordering</a>.
The filters are listed in the order in which they occur in the filter chain.</p>
</div>
<table id="filter-stack" class="tableblock frame-all grid-all stretch">
<caption class="title">Table 1. Standard Filter Aliases and Ordering</caption>
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Alias</th>
<th class="tableblock halign-left valign-top">Filter Class</th>
<th class="tableblock halign-left valign-top">Namespace Element or Attribute</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">CHANNEL_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ChannelProcessingFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/<a href="https://docs.spring.io/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="543d3a203126373124207921263814263125213d26312779373c353a3a3138">[email&#160;protected]</a></code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SECURITY_CONTEXT_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>SecurityContextPersistenceFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">CONCURRENT_SESSION_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ConcurrentSessionFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>session-management/concurrency-control</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">HEADERS_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>HeaderWriterFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/headers</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">CSRF_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>CsrfFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/csrf</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">LOGOUT_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>LogoutFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/logout</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">X509_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>X509AuthenticationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/x509</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">PRE_AUTH_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>AbstractPreAuthenticatedProcessingFilter</code> Subclasses</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">N/A</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">CAS_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>CasAuthenticationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">N/A</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">FORM_LOGIN_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>UsernamePasswordAuthenticationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/form-login</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">BASIC_AUTH_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>BasicAuthenticationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/http-basic</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SERVLET_API_SUPPORT_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>SecurityContextHolderAwareRequestFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/@servlet-api-provision</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">JAAS_API_SUPPORT_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>JaasApiIntegrationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/@jaas-api-provision</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">REMEMBER_ME_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>RememberMeAuthenticationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/remember-me</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ANONYMOUS_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>AnonymousAuthenticationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http/anonymous</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SESSION_MANAGEMENT_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>SessionManagementFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>session-management</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">EXCEPTION_TRANSLATION_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>ExceptionTranslationFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">FILTER_SECURITY_INTERCEPTOR</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>FilterSecurityInterceptor</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>http</code></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SWITCH_USER_FILTER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>SwitchUserFilter</code></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">N/A</p></td>
</tr>
</tbody>
</table>
<div class="paragraph">
<p>You can add your own filter to the stack, using the <code>custom-filter</code> element and one of these names to specify the position your filter should appear at:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;http&gt;
&lt;custom-filter position="FORM_LOGIN_FILTER" ref="myFilter" /&gt;
&lt;/http&gt;

&lt;beans:bean id="myFilter" class="com.mycompany.MySpecialAuthenticationFilter"/&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>You can also use the <code>after</code> or <code>before</code> attributes if you want your filter to be inserted before or after another filter in the stack.
The names "FIRST" and "LAST" can be used with the <code>position</code> attribute to indicate that you want your filter to appear before or after the entire stack, respectively.</p>
</div>
<div class="admonitionblock tip">
<table>
<tr>
<td class="icon">
<i class="fa icon-tip" title="Tip"></i>
</td>
<td class="content">
<div class="title">Avoiding filter position conflicts</div>
<div class="paragraph">
<p>If you are inserting a custom filter which may occupy the same position as one of the standard filters created by the namespace then it&#8217;s important that you don&#8217;t include the namespace versions by mistake.
Remove any elements which create filters whose functionality you want to replace.</p>
</div>
<div class="paragraph">
<p>Note that you can&#8217;t replace filters which are created by the use of the <code>&lt;http&gt;</code> element itself - <code>SecurityContextPersistenceFilter</code>, <code>ExceptionTranslationFilter</code> or <code>FilterSecurityInterceptor</code>.
Some other filters are added by default, but you can disable them.
An <code>AnonymousAuthenticationFilter</code> is added by default and unless you have <a href="../authentication/session-management.html#ns-session-fixation" class="xref page">session-fixation protection</a> disabled, a <code>SessionManagementFilter</code> will also be added to the filter chain.</p>
</div>
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>If you&#8217;re replacing a namespace filter which requires an authentication entry point (i.e. where the authentication process is triggered by an attempt by an unauthenticated user to access to a secured resource), you will need to add a custom entry point bean too.</p>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="ns-method-security"><a class="anchor" href="xml-namespace.html#ns-method-security"></a>Method Security</h2>
<div class="sectionbody">
<div class="paragraph">
<p>From version 2.0 onwards Spring Security has improved support substantially for adding security to your service layer methods.
It provides support for JSR-250 annotation security as well as the framework&#8217;s original <code>@Secured</code> annotation.
From 3.0 you can also make use of new <a href="../authorization/expression-based.html#el-access" class="xref page">expression-based annotations</a>.
You can apply security to a single bean, using the <code>intercept-methods</code> element to decorate the bean declaration, or you can secure multiple beans across the entire service layer using the AspectJ style pointcuts.</p>
</div>
</div>
</div>
<div class="sect1">
<h2 id="ns-access-manager"><a class="anchor" href="xml-namespace.html#ns-access-manager"></a>The Default AccessDecisionManager</h2>
<div class="sectionbody">
<div class="paragraph">
<p>This section assumes you have some knowledge of the underlying architecture for access-control within Spring Security.
If you don&#8217;t you can skip it and come back to it later, as this section is only really relevant for people who need to do some customization in order to use more than simple role-based security.</p>
</div>
<div class="paragraph">
<p>When you use a namespace configuration, a default instance of <code>AccessDecisionManager</code> is automatically registered for you and will be used for making access decisions for method invocations and web URL access, based on the access attributes you specify in your <code>intercept-url</code> and <code>protect-pointcut</code> declarations (and in annotations if you are using annotation secured methods).</p>
</div>
<div class="paragraph">
<p>The default strategy is to use an <code>AffirmativeBased</code> <code>AccessDecisionManager</code> with a <code>RoleVoter</code> and an <code>AuthenticatedVoter</code>.
You can find out more about these in the chapter on <a href="../authorization/architecture.html#authz-arch" class="xref page">authorization</a>.</p>
</div>
<div class="sect2">
<h3 id="ns-custom-access-mgr"><a class="anchor" href="xml-namespace.html#ns-custom-access-mgr"></a>Customizing the AccessDecisionManager</h3>
<div class="paragraph">
<p>If you need to use a more complicated access control strategy then it is easy to set an alternative for both method and web security.</p>
</div>
<div class="paragraph">
<p>For method security, you do this by setting the <code>access-decision-manager-ref</code> attribute on <code>global-method-security</code> to the <code>id</code> of the appropriate <code>AccessDecisionManager</code> bean in the application context:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;global-method-security access-decision-manager-ref="myAccessDecisionManagerBean"&gt;
...
&lt;/global-method-security&gt;</code></pre>
</div>
</div>
<div class="paragraph">
<p>The syntax for web security is the same, but on the <code>http</code> element:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;http access-decision-manager-ref="myAccessDecisionManagerBean"&gt;
...
&lt;/http&gt;</code></pre>
</div>
</div>
</div>
</div>
</div>
<div id="footnotes">
<hr>
<div class="footnote" id="_footnotedef_1">
<a href="xml-namespace.html#_footnoteref_1">1</a>. You can find out more about the use of the <code>ldap-server</code> element in the chapter on xref:servlet/authentication/unpwd/ldap.adoc#servlet-authentication-ldap[LDAP Authentication
</div>
<div class="footnote" id="_footnotedef_2">
<a href="xml-namespace.html#_footnoteref_2">2</a>. See the section on xref:servlet/exploits/firewall.adoc#servlet-httpfirewall[`HttpFirewall`
</div>
<div class="footnote" id="_footnotedef_3">
<a href="xml-namespace.html#_footnoteref_3">3</a>. The interpretation of the comma-separated values in the <code>access</code> attribute depends on the implementation of the <a href="xml-namespace.html#ns-access-manager">AccessDecisionManager</a> which is used.
</div>
</div>
<nav class="pagination">
<span class="prev"><a href="kotlin.html">Kotlin Configuration</a></span>
<span class="next"><a href="../test/index.html">Testing</a></span>
</nav>
</article>
</div>
</main>
</div>
<footer class="footer flex">
<div id="spring-links flex">
<img id="springlogo" src="../../../_/img/spring-logo.svg" alt="Spring">
<p class="smallest antialiased">© <script data-cfasync="false" src="https://docs.spring.io/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script>var d = new Date();
        document.write(d.getFullYear());</script> <a href="https://www.vmware.com/">VMware</a>, Inc. or its affiliates. <a href="https://www.vmware.com/help/legal.html">Terms of Use</a> • <a href="https://www.vmware.com/help/privacy.html" rel="noopener noreferrer">Privacy</a> • <a href="https://spring.io/trademarks">Trademark Guidelines</a> <span id="thank-you-mobile">• <a href="https://spring.io/thank-you">Thank you</a></span> • <a href="https://www.vmware.com/help/privacy/california-privacy-rights.html">Your California Privacy Rights</a> • <a class="ot-sdk-show-settings">Cookie Settings</a> <span id="teconsent"></span></p>
<p class="smallest antialiased">Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra&trade;, and Apache Geode&trade; are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java&trade;, Java&trade; SE, Java&trade; EE, and OpenJDK&trade; are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners.</p>
</div>
<div id="social-icons" class="flex jc-between">
<a href="https://www.youtube.com/user/SpringSourceDev" title="Youtube"><svg id="youtube-icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 40 40"><circle class="cls-1" cx="20" cy="20" r="20" /><path class="cls-2" d="M30.91,14.53a2.89,2.89,0,0,0-2-2C27.12,12,20,12,20,12s-7.12,0-8.9.47a2.9,2.9,0,0,0-2,2A30.56,30.56,0,0,0,8.63,20a30.44,30.44,0,0,0,.46,5.47,2.89,2.89,0,0,0,2,2C12.9,28,20,28,20,28s7.12,0,8.9-.47a2.87,2.87,0,0,0,2-2A30.56,30.56,0,0,0,31.37,20,28.88,28.88,0,0,0,30.91,14.53ZM17.73,23.41V16.59L23.65,20Z" /></svg></a>
<a href="https://github.com/spring-projects" title="Github"><svg id="github-icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 75.93 75.93"><path class="cls-1" d="M38,0a38,38,0,1,0,38,38A38,38,0,0,0,38,0Z" /></g><path class="cls-2" d="M38,15.59A22.95,22.95,0,0,0,30.71,60.3c1.15.21,1.57-.5,1.57-1.11s0-2,0-3.9c-6.38,1.39-7.73-3.07-7.73-3.07A6.09,6.09,0,0,0,22,48.86c-2.09-1.42.15-1.39.15-1.39a4.81,4.81,0,0,1,3.52,2.36c2,3.5,5.37,2.49,6.67,1.91a4.87,4.87,0,0,1,1.46-3.07c-5.09-.58-10.45-2.55-10.45-11.34a8.84,8.84,0,0,1,2.36-6.15,8.29,8.29,0,0,1,.23-6.07s1.92-.62,6.3,2.35a21.82,21.82,0,0,1,11.49,0c4.38-3,6.3-2.35,6.3-2.35a8.29,8.29,0,0,1,.23,6.07,8.84,8.84,0,0,1,2.36,6.15c0,8.81-5.37,10.75-10.48,11.32a5.46,5.46,0,0,1,1.56,4.25c0,3.07,0,5.54,0,6.29s.42,1.33,1.58,1.1A22.94,22.94,0,0,0,38,15.59Z" /></svg></a>
<a href="https://twitter.com/springcentral" title="Twitter"><svg id="twitter-icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 75.93 75.93"><circle class="cls-1" cx="37.97" cy="37.97" r="37.97" /><path id="Twitter-2" data-name="Twitter" class="cls-2" d="M55.2,22.73a15.43,15.43,0,0,1-4.88,1.91,7.56,7.56,0,0,0-5.61-2.49A7.78,7.78,0,0,0,37,30a7.56,7.56,0,0,0,.2,1.79,21.63,21.63,0,0,1-15.84-8.23,8,8,0,0,0,2.37,10.52,7.66,7.66,0,0,1-3.48-1v.09A7.84,7.84,0,0,0,26.45,41a7.54,7.54,0,0,1-2,.28A7.64,7.64,0,0,1,23,41.09a7.71,7.71,0,0,0,7.18,5.47,15.21,15.21,0,0,1-9.55,3.37,15.78,15.78,0,0,1-1.83-.11,21.41,21.41,0,0,0,11.78,3.54c14.13,0,21.86-12,21.86-22.42,0-.34,0-.68,0-1a15.67,15.67,0,0,0,3.83-4.08,14.9,14.9,0,0,1-4.41,1.24A7.8,7.8,0,0,0,55.2,22.73Z" /></svg></a>
</div>
</footer>
<script src="../../../_/js/site.js"></script>
<script async src="../../../_/js/vendor/highlight.js"></script>
<script async src="../../../_/js/vendor/tabs.js"></script>
<script src="../../../_/js/vendor/switchtheme.js"></script>
<script src="../../../_/js/vendor/docsearch.min.js"></script>

<script>
var search = docsearch({
  appId: '244V8V9FGG',
  apiKey: '82c7ead946afbac3cf98c32446154691',
  indexName: 'security-docs',
  inputSelector: '#search-input',
  autocompleteOptions: { hint: false, keyboardShortcuts: ['s'] },
  algoliaOptions: { hitsPerPage: 10 }
}).autocomplete
search.on('autocomplete:closed', function () { search.autocomplete.setVal() })
</script>
<script>if (window.parent == window) {(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)})(window,document,'script','//www.google-analytics.com/analytics.js','ga');ga('create', 'UA-2728886-23', 'auto', {'siteSpeedSampleRate': 100});ga('send', 'pageview');}</script><script defer src="https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194" integrity="sha512-Gi7xpJR8tSkrpF7aordPZQlW2DLtzUlZcumS8dMQjwDHEnw9I7ZLyiOj/6tZStRBGtGgN6ceN6cMH8z7etPGlw==" data-cf-beacon='{"rayId":"702d70adfb8a96ad","token":"bffcb8a918ae4755926f76178bfbd26b","version":"2021.12.0","si":100}' crossorigin="anonymous"></script>
</body>
</html>
